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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 
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earned patent term adjustment. See 37 CFR 1 .704(b). 
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1 )KI Responsive to communication(s) filed on 29 December 2011 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) D An election was made by the applicant in response to a restriction requirement set forth during the interview on 
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4) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
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1 . This action is responsive to the amendment filed on December 29, 201 1 . 

2. Claims 1, 3-11, 13-17, 19-21 and 23-35 are presented for examination and claims 2, 12, 
18, 22 and 36 are canceled. 

3. The text of those sections of Title 35, U.S. code not included in this office action can be 
found in a prior office action. 

Objection 

4. Claim 35 is objected to because of the following typographical error: Line 8, "an IF 
address" should be "an IP address". Claim 33 is objected to because of the following 
typographical error: Line 1, "3D" should be "30". Appropriate correction is required. 

Claim Rejections - 35 USC § 112 

5. The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making and 
using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or 
with which it is most nearly connected, to make and use the same and shall set forth the best mode contemplated by 
the inventor of carrying out his invention. 

7. Claims 1 and 35 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply 
with the written description requirement. The claim(s) contains subject matter which was not 
described in the specification in such a way as to reasonably convey to one skilled in the relevant 
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art that the inventor(s), at the time the application was filed, had possession of the claimed 
invention. Although the specification described the whitelist is overridden and the received 
message is classified as spam in accordance with the score assigned to the address-domain pair, 
however, the disclosure does not describe the spam classification based on no common 
classification across the plurality of IP addresses associated with the domain. It is noted that the 
examples disclosed in pages 15 and 16 of the specification are based on common classification. 



Claim Rejections - 35 USC §103 



6. Claims 1, 3, 5, 7-10, 13-17, 19, 28, 30-31 and 33-35 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Kirsch, US Patent 7,206,814 (hereinafter Kirsch) in view of Wang, 
US Patent Application Publication 2008/0040439 (hereinafter Wang). 

7. As per claims 1 and 35, Kirsch teaches the invention substantially as claimed, 
comprising: maintaining a reputation table in memory (i.e., list of information regarding the 
actual senders), the reputation table including information regarding a plurality of address- 
domain pairs(i.e., actual senders are identified by IP and domain pair), each of the plurality of 
address-domain pairs indicating an IP address and an associated domain of a previously received 
message (col. 3, lines 7-13; col. 9, lines 2 — 31; col. 11, lines 24-30; col. 16, lines 27-32), the 
information regarding each of the plurality of address-domain pairs including a score based on 
one or more classification variables (i.e., scores are ratio of classification variables) (col. 11, 
lines 24-60); 



Application/Control Number: 10/776,677 Page 4 

Art Unit: 2453 

receiving the message transmitted over the network and addressed to a recipient (col. 4, 
line 66-col. 5, line 12); and 

executing instructions stored in a non-transitory computer readable storage medium to: 

determine an associated domain from which the received message is purported to be sent 
(col. 4, line 66-col. 5, line 12), 

identify that the determined domain appears on a whitelist associated with the 
recipient (col. 4, line 66-col. 5, line 12), 

determine an IP address corresponding to a device from which the received message was 
relayed (col. 7, lines 35-37), 

associate the determined domain with the IP address to create an address-domain pair for 
the received message(col. 6, lines 10-40); 

assign a score to the received message, the score comprising a ratio (col. 12, lines 12-13) 
of a first classification variable of the address-domain pair to a second classification variable of 
the address-domain pair as indicated by the reputation table, wherein the score is indicative of 
spam (col. 11, lines 24-60), and 

classify the received message according to whether a common classification appears 
across a plurality of IP addresses associated with the domain (col. 9, lines 2-19 and col. 7, lines 
1-4), wherein 

the score is overridden and the received message is classified as good in accordance with 
the whitelist (col. 19, lines 7-14), the good classification based on a common classification (col. 
9, lines 2-19) appearing across the plurality of IP addresses associated with the domain (col. 7, 
lines 1-4), and 
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the whitelist is overridden and the received message is classified as spam in accordance 
with the score assigned to the address-domain pair (col. 19, lines 7-14), the spam classification 
based on no common spam classification (col. 9, lines 2-19) appearing across the plurality of IP 
addresses associated with the domain (col. 7, lines 1-4). 

8. Kirsch does not teach variable decaying with time. Wang teaches the one or more 
classification variables decaying with time ([0046], [0047] and claims 5 and 22). 

9. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch and Wang because Wang's teaching of 
variables decaying with time would increase the security of their system by allowing their system 
to determine whether to accept or reject messages on the basis of the classification of the sender. 

10. As per claim 3, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach classifying the received message is further based on classification 
variables associated with another address-domain pair (i.e., classification based on range of IP 
combined with certain domain name), the other address- domain pair having a related IP address 
or related domain (col. 2, lines 58-64; col. 6, line 59-col. 7, line 4). 

11. As per claim 5, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein a plurality of IP addresses is associated with the domain 
(col. 2, lines 63-64). 
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12. As per claim 7, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teaches wherein the IP address is a boundary IP address (col. 7, line 30). 

13. As per claim 8, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein the IP address is preconfigured (col. 4, line 66-col. 5, line 
6). 

14. As per claim 9, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Although Kirsch teaches wherein the IP address is preconfigured (col. 4, line 66-col. 5, 
line 6), however, Kirsch and Wang do not specifically teaches including wherein the IP address 
is preconfigured to be one hop from a gateway IP address. It would have been obvious to one 
having ordinary skill in the art at the time of the invention was made to include IP address 
preconfigured to be one hop or any hop from a gateway IP address because by doing so it would 
increase the user control by allowing configuration according to the user's design choice. 

15. As per claim 10, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein the IP address is learned (col. 1, lines 24-25) (learned from 
the header). 

16. As per claim 13, Kirsch and Wang teach the invention substantially as claimed in claim 
10 above. Kirsch further teach wherein the IP address is a boundary IP address (col. 7, line 30) 
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and wherein the boundary IP address is learned by detecting a pattern in a certain number of 
previously received messages (col. 7, lines 20-45). 

17. As per claim 14, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein determining the domain from which the received message is 
purported to be sent includes identifying the stated sender domain associated with the received 
message (col. 7, lines 55-64). 

18. As per claim 15, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teaches wherein the domain is a domain associated with a boundary IP 
address (col. 7, lines 30, 49-54). 

19. As per claim 16, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on 
consulting a white list (col. 8, lines 31-38). 

20. As per claim 17, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on 
previous classifications made to the address-domain pair (col. 12, lines 1-30). 

21. As per claim 19, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach determining a spam ratio (col. 12, lines 12-14). 
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22. As per claim 28, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teaches providing the classification of the received message based on the 
address-domain pair as input to another classifier (col. 8, lines 17-62). 

23. As per claim 30, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on a score 
assigned to the IP address (col. 12, lines 24-30). 

24. As per claim 31, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on a score 
assigned to the domain (col. 12, lines 24-30). 

25. As per claim 33, Kirsch and Wang teach the invention substantially as claimed in claim 

30 above. Kirsch further teach comprising determining a score assigned to the IP address 
(Kirsch, col. 12, lines 1-30). 

26. As per claim 34, Kirsch and Wang teach the invention substantially as claimed in claim 

31 above. Kirsch further teach comprising determining a score assigned to the domain (Kirsch, 
col. 12, lines 1-30). 
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27. Claims 4 and 32 rejected under 35 U.S.C. 103(a) as being unpatentable over Kirsch and 
Wang as applied to claim 1 above, and further in view of Lalonde et al, US Patent Application 
Publication 2004/0068542 (hereinafter Lalonde). 

28. As per claim 4, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not the other message being associated with IP addresses other than 
the IP address of the message. Lalonde teaches wherein classifying the received message is 
further based on classifications of other messages associated with the domain of the received 
message (i.e., checking the blacklist) ([0042]), the other message further being associated with IP 
addresses other than the IP address of the received message ([0039]). 

29. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Lalonde because Lalonde' s 
teaching of further classification of the message would increase the security of Kirsch' s and 
Wang's systems by further indentifying associated information regarding a message in order to 
determine and to filter unwanted message. 

30. As per claim 32, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Although Kirsch teaches classifying the message based on a score assigned to the 
domain (col. 12, lines 24-30), however, Kirsch and Wang do not determining the received 
message was forged. Lalonde teaches wherein classifying includes classifying the message 
based on the domain and determining that the received message was forged ([0038]). 
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31. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Lalonde because Lalonde 's 
teaching of further classification of the message would increase the security of Kirsch's and 
Wang's systems by further indentifying associated information regarding a message in order to 
determine and to filter unwanted message. 

32. Claims 6, 1 1, 20-21 and 23-27 rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kirsch and Wang as applied to claim 1 above, and further in view of Murray et al, U.S. 
Patent 7,366761 (hereinafter Murray). 

33. As per claim 6, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach the IP address is associated with a plurality of domains. 
Murray teaches wherein the IP address is associated with plurality of domains (col. 7, line 65- 
col. 8, line 4). 

34. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Lalonde, Kirsch, Wang and Murray because 
Murray's teaching of the IP address is associated with plurality of domains would increase the 
effectiveness of their system by allowing identification of the IP address is associated with the 
domain in order to filter unwanted e-mails based on sender information. 
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35. As per claim 11, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach including the IP address is adaptively determined. Murray 
teaches wherein the IP address is adaptively determined (col. 3, lines 25-27). 

36. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of the IP address is adaptively determined would increase the effectiveness of their 
system by allowing determination of the IP address in order to filter unwanted e-mails based on 
sender information. 

37. As per claim 20, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not specifically teach a spam rate. Murray teaches determining a 
spam rate (col. 10, lines 53-65). 

38. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of determining a spam rate would increase the effectiveness of their system by allowing 
identification of unwanted e-mails based on spam rate. 

39. As per claim 21, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not specifically teach a spam rate. Murray teaches determining an 
estimated instantaneous spam rate (col. 10, lines 53-65; col. 11, lines 24-27). 
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40. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of determining a spam rate would increase the effectiveness of their system by allowing 
identification of unwanted e-mails based on spam rate. 



41. As per claim 23, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach giving a classification weight relative to another 
classification. Murray teaches wherein classifying the received message includes giving a 
classification variable greater weight relative to another classification variable (col. 9, lines 20- 
31). 



42. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of giving a classification greater weight relative to another classification would increase 
the effectiveness of their system by allowing unwanted e-mails to be accurately identified based 
on sender's reputation. 



43. As per claim 24, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach giving a classification weight relative to a computer 
classification. Murray teaches wherein classifying the received message includes giving a 
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classification variable associated with user greater weight relative to a classification variable 
associated with computer classification (col. 8, lines 44-50; col. 9, lines 20-31). 

44. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of giving a classification greater weight relative to a computer classification would 
increase the effectiveness of their system by allowing unwanted e-mails to be accurately 
identified based on complied sender's reputation. 

45. As per claim 25, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach giving weight of a good classification. Murray teaches 
wherein classifying the received message includes giving an indeterminate classification a 
fraction of the weight of a good classification (col. 9, lines 20-31). 

46. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of giving weight to a good classification would increase the effectiveness of their 
system by allowing unwanted e-mails to be accurately identified based on sender's good 
reputation. 

47. As per claims 26 and 27, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Although Kirsch teaches the reputation table (col. 3, lines 7-13; col. 9, lines 20- 
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31), however, Kirsch and Wang do not specifically teach the table indexed by IP address and 
domain. Murray teaches wherein the table is indexed by IP address and domain wherein each 
cell includes information about previous classifications (col. 9, lines 32-40). 

48. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of consulting a table of IP address and domain would increase the effectiveness of their 
system by allowing unwanted e-mails to be accurately identified based on sender's information. 

49. Claim 29 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kirsch and Wang 
as applied to claim 1 above, and further in view of Appleman, U.S. Patent Application 
Publication 2005/0076240 (hereinafter Appleman). 

50. As per claim 29, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not specifically teach a Bayesian classifier. Appleman teach 
wherein the other classifier is a Bayesian classifier ([0058]). 

51. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Appleman because 
Appleman' s teaching of providing the IP address and domain classification as input to a 
Bayesian classifier would increase the effectiveness of their system by allowing unwanted e- 
mails to be accurately identified based on sender's information. 
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52. Applicant's arguments filed on 12/29/11 with respect to claims 1, 3-11, 13-17, 19-21 and 
23-35 have been considered but they are not persuasive. 

53. In the remarks, applicant argued that: 

(1) The prior arts of record fail to teach classification of the received 
message based on whether there is a common classification across IP 
addresses associated with the domain. 

In response to point (1), Kirsch teaches if the sender is on the whitelist, the message is passed on 
to the recipient (for instance, placed in the recipient's inbox) (col. 5, lines 60-62). Kirsch teaches 
higher weight is given to manual (explicit) reversals of whitelist/blacklist status than implicit 
rankings (where, for instance, a sender is automatically placed on a whitelist because of the 
sender's reputation rather than a user explicitly placing the sender on the whitelist) (col. 18, lines 
38-43). This means there is two types of whitelist, an explicit whitelist and an implicit whitelist. 
Kirsch further teach the Inbox is periodically reevaluated to determine if the rating of any of 
senders of messages in the inbox has changed. If the sender's reputation is no longer "good" and 
the sender has not been explicitly whitelisted by the recipient, the message can be removed to a 
spam folder and processed accordingly or deleted, depending on the rating and the recipient's 
settings (col. 19, lines 7-14). This means message of sender in the whitelist (message in the 
Inbox, i.e., implicit whitelist not explicitly whitelisted) can be changed to spam based on the 
calculated reputation of the sender. A reputation of a sender is determined by a score used for 
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classification of the received message as good or spam. The score is determined based on a 
number of factors including recipients that have wished to receive or not to receive the message 
(col. 9, lines 2-19) (i.e., "common classification" as disclosed in page 15 of applicant's 
specification ) from a sender that have information associated with a range of IP addresses 
associated with the domain (col. 7, lines 1-4). 

54. A shortened statutory period for reply to this Office action is set to expire THREE 
MONTHS from the mailing date of this action. Any inquiry concerning this communication or 
earlier communications from the examiner should be directed to Philip C Lee whose telephone 
number is (571)272-3967. The examiner can normally be reached on 8 AM TO 5:30 PM 
Monday to Thursday and every other Friday. If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Krista Zele can be reached on (571) 272-7288. The fax 
phone number for the organization where this application or proceeding is assigned is 571-273- 
8300. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http ://p air-direct . usp to .go v . Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



/Philip C Lee/ 

Primary Examiner, Art Unit 2453 



Application/Control Number: 10/776,677 Page 17 

Art Unit: 2453 



